SEOUL – North Korea’s TraderTraitor hacking group has been blamed by the US authorities for stealing greater than US$6 billion (S$7.7 billion) in digital belongings from Binance, in what’s believed to be the largest crypto heist in history.
The Oct 29 assault is the newest in a string of high-profile cyberthefts linked to Pyongyang, which has constructed a formidable hacking operation, producing funds believed to assist finance its weapons programme.
Listed here are 5 issues to know concerning the group and its place in North Korea’s cyberwarfare programme:
Who’re they?
TraderTraitor is the title given to a North Korean hacking operation linked to the broader Lazarus Group, which gained notoriety in 2014 when it hacked Sony Photos in retaliation for The Interview, a satirical movie that mocked North Korean chief Kim Jong Un.
Pyongyang has invested closely in creating its cybercapabilities since at the very least the mid-Nineteen Nineties, constructing a power that South Korean intelligence estimated in 2024 comprised round 8,400 personnel.
“North Korea has constructed a succesful cyberforce, funnelling most of the nation’s prime college students into laptop science and IT coaching,” the US Federal Bureau of Investigation (FBI) stated on its web site.
A lot of the hacking exercise is thought to have been directed by Pyongyang’s Reconnaissance Common Bureau, its main international intelligence company.
“The highest two college students in my class have been recruited to the hacking unit,” South Korean MP Park Choong-kwon, who studied on the North’s elite Nationwide Protection College earlier than his defection, advised AFP in a 2024 interview.
How do they function?
TraderTraitor actors have been identified to pose as recruiters providing profitable jobs to trick victims into downloading malicious software program.
The malware can permit hackers to infiltrate victims’ laptop techniques and steal delicate info and digital belongings.
In a 2024 heist involving the theft of US$308 million from Japanese cryptocurrency alternate DMM Bitcoin, a North Korean hacker posing as a recruiter on LinkedIn contacted an worker of a separate digital foreign money pockets software program firm.
They despatched the worker what seemed to be a pre-employment take a look at, which really contained a malicious line of code.
That allowed the hacker to compromise their system and impersonate the worker, the FBI stated.
What have North Korean hackers carried out?
Excessive-profile cyberattacks attributed to North Korean hackers embody the theft of US$81 million from Bangladesh’s central financial institution in 2016 and the WannaCry ransomware assault that disrupted computer systems worldwide in 2017.
In 2022, the US authorities blamed Lazarus-linked hackers for stealing some US$620 million from the Ronin blockchain community.
The FBI subsequently attributed three extra cryptocurrency heists in 2023 to TraderTraitor actors, involving the theft of practically US$200 million from Atomic Pockets, AlphaPo and Coinspaid.
The size of the thefts elevated dramatically in February 2025, when the FBI blamed TraderTraitor for stealing round US$1.5 billion in digital belongings from cryptocurrency alternate Bybit.
“TraderTraitor actors are continuing quickly and have transformed a number of the stolen belongings,” the FBI stated on the time.
How does North Korea use stolen funds?
The North Korean regime launders stolen cryptocurrency and converts it into money “by means of mixing companies or non-public exchanges”, Lim Eul-chul, a professor on the Institute for Far Jap Research at Kyungnam College, advised AFP.
“The proceeds are then channelled instantly into army analysis, the illicit procurement of weapons parts and the defence trade,” he added.
A 2024 United Nations report stated proceeds from North Korean cyberattacks “reportedly helped to fund the nation’s growth of weapons of mass destruction”.
Why cybercrime?
Analysts say Pyongyang’s illicit cyberactivity is pushed by its capability to acquire huge sums of cash shortly and at “minimal price”.
“Whereas worldwide sanctions severely limit North Korea’s capability to earn international foreign money by means of typical commerce, cybertheft permits it to amass billions of {dollars} with minimal personnel and assets,” stated Lim.
“Hacking provides Pyongyang a option to acquire funds outdoors typical banking channels, profiting from the pseudonymous and borderless nature of digital belongings to bypass monetary restrictions,” he added.
AFP
